Malware Moved Its Address Book Onto Polygon, Where Takedowns Don't Reach

Every piece of malware has the same awkward requirement: at some point it has to phone home, and to phone home it needs an address. That address is the single most fragile thing an attacker owns. Write it into the binary and a defender reads it out with a hex editor. Register it as a domain and a registrar can seize it. Host it on a server and a provider can pull the plug. Decades of takedown work rest on the fact that command-and-control infrastructure has to live somewhere seizable.

Three investigations published between late July and the start of September describe the same workaround, arrived at independently by what appear to be separate operators. The address is not in the malware. It is in a smart contract on Polygon, and the malware fetches it at runtime with an ordinary read call.

The technique has a name — EtherHiding — and it is not new. GuidePoint Security dates its first appearance in criminal campaigns to 2023. What changed this summer is volume and variety.

Three contracts, three operations

The clearest way to see the spread is to line the cases up. They share a technique and nothing else — different lures, different targets, different contracts.

Cribl SecOps, publishing on August 11, traced a campaign that began in an unlikely place: a script planted in a compromised WordPress site's robots.txt file — a text file that normally does nothing but tell search engines which pages to skip. The script queried Polygon through public RPC endpoints, called a contract at 0x0C7Cb01C…7eF55, and got back an encoded domain for its second stage. Cribl found eleven domain-rotation transactions on that contract, and linked its creator to twenty-six transactions across four separate contracts using the same method.

UnderDefense, publishing on July 29, documented a different operation entirely: a free browser extension called VeiloVPN that, by the firm's account, gathered tens of thousands of users and then sat dormant, polling its server every five minutes waiting to be switched on. When the flag flipped for a selected user, a ClickFix popup — the now-familiar fake verification prompt that asks a human to paste a command into a terminal — installed a macOS loader that persisted via a randomised LaunchAgent. Its command server address lived at contract 0xA3a603F8…C2A0. UnderDefense's summary is the most economical description of the technique this desk has read: "The C2 address wasn't in the script at all, it sat inside a Polygon smart contract, and the loader just did an eth_call to read it."

That operator updated the stored address sixteen times over sixty-seven days.

GuidePoint's September 1 analysis, by Jean-Pierre Mouton, supplies the scale the other two lack. It counts at least thirty-one legitimate organisations whose websites were compromised to serve the fake-CAPTCHA lure, across e-commerce, professional services and retail logistics. The resulting implant, GuidePoint says, "beacons to C2 every minute."

Why the pointer is the point

Nothing here exploits a flaw in Polygon. No contract was hacked and no chain misbehaved. The attackers are using the network exactly as designed — paying a trivial fee to store a small piece of data and read it back — and that is the uncomfortable part.

A public blockchain offers a specific combination that conventional hosting cannot. The data is readable by anyone without an account or an API key. It is served by dozens of independent public RPC providers, so blocking one changes nothing; Cribl listed eight distinct Polygon endpoints in the campaign it examined, and UnderDefense listed four more. There is no registrar to serve, no host to notify, no single operator who could remove the record even if compelled. GuidePoint puts the attraction plainly: Polygon is "a permanent, distributed ledger that no single entity can take offline."

And the economics are absurd. Redirecting every infected machine to fresh infrastructure means one transaction, at what GuidePoint describes as "fractions of a cent per transaction." Sixteen rotations over sixty-seven days is not a sophisticated operation straining its budget. It is someone changing a value in a database that happens to be uncensorable.

The defensive consequence follows directly. As GuidePoint's write-up states, "blocking a singular domain or IP address alone does not permanently sever attacker access." The blocked domain was never the infrastructure. It was one entry in an address book that lives somewhere no one can reach.

Related Polygon's Austin and Kyoto patches were public for a month before anyone said why

What is claimed, and by whom

Two of GuidePoint's assertions deserve labelling as GuidePoint's rather than as settled fact. The firm reports that North Korean state actors adopted the technique by late 2025 and Iran-linked groups by early 2026. This desk has not independently verified either attribution, and the other two investigations make no nation-state claim at all. Treat those as one vendor's assessment.

What all three do agree on is less dramatic and more useful: the technique has escaped whatever niche it started in. Three unrelated campaigns, three contracts, a browser extension on one side and a compromised CMS on the other, inside six weeks.

GuidePoint adds one detail that should worry anyone who has ever ticked a remediation box. Several of the compromised sites in its investigation were cleaned up, then "silently re-compromised weeks later." A site that was fixed in July is not necessarily a site that is clean in September.

What a defender can actually do

The reporting points at one leverage point. The malware's lookup is not magic — it is an outbound HTTPS request from an ordinary endpoint to a public blockchain RPC provider. On a workstation belonging to a logistics company, that request has no legitimate business explanation.

Blockchain RPC traffic from non-developer endpoints is a narrow, high-signal indicator, and it does not degrade when the attacker rotates a domain, because the rotation happens on the far side of the lookup. The contract addresses in these reports are burned the moment they are published. The behaviour is not.

The other half is the lure, and it is depressingly low-tech. Both the ClickFix chains here depend on persuading a person to copy a command and paste it into a terminal. No amount of ledger immutability helps an attacker who cannot get that far.